The General Data Protection Regulation (GDPR) (EU) 2016/679 is a regulation in European Union law on data protection and privacy for all individuals within the European Union and the European Economic Area. The GDPR primarily aims to give individuals control over their personal information and to bring companies within the EU into compliance with these rules.
Parties that process personal data are required to take the technical and organizational measures necessary to apply data protection principles. Business processes that handle personal data must be designed and carried out with data protection principles in mind, and measures must be taken to protect the data. No personal data may be processed unless it is done as set out in the regulation or explicit consent is obtained from the person concerned (the data subject). The person concerned has the right to withdraw this consent at any time.
In every data collection activity, those who process personal data must clearly state the purpose of processing, its legal basis, how long the data will be stored, and whether it will be shared with any third party or anywhere outside the European Economic Area. Data subjects have the right to request a copy of the data stored about them at any time and, under certain conditions, to have that data deleted. Businesses must notify users within 72 hours of any data breach that adversely affects user privacy (for example, theft of information).
Companies found to have violated the regulation can be fined up to 20 million euros or up to 4% of the company's annual revenue (whichever is higher).
The General Data Protection Regulation was adopted on 14 April 2016 and has been in force since 25 May 2018. The GDPR is not a directive; it is a directly binding and applicable regulation.
The regulation covers all controllers within the European Union (organizations that collect data from EU citizens), processors (organizations that process data on behalf of the controller) and data subjects (the individuals the data belongs to). The regulation also covers companies outside the EU that process the data of EU citizens.
The regulation does not apply to national security activities or to the enforcement of EU law. EU member states must establish an independent supervisory authority to examine complaints and launch investigations. Supervisory authorities must cooperate with the authorities of other member states and organize joint activities.
